ci-cd.yml

name: CI/CD Optimized

on:
  merge_group:
  pull_request:
  push:
  workflow_dispatch:
  workflow_run:
    workflows: ["Pre-commit fix"]
    types:
      - completed

env:
  FORCE_COLOR: 1

concurrency:
  cancel-in-progress: true
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}

jobs:
  setup:
    name: Setup and Cache Dependencies
    runs-on: ubuntu-latest
    permissions: 
      contents: read  # Minimal permission for checking out code
    outputs:
      python-cache-dir: ${{ steps.poetry-cache.outputs.dir }}
    steps:
      - uses: actions/checkout@v4
      
      - name: Cache pre-commit hooks
        uses: actions/cache@v3
        with:
          path: ~/.cache/pre-commit
          key: ${{ runner.os }}-pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pre-commit-

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: 3.11.2

      - name: Get Poetry cache directory
        id: poetry-cache
        run: echo "POETRY_CACHE_DIR=$(poetry config cache-dir)" >> $GITHUB_ENV
      
      - name: Cache Poetry dependencies
        uses: actions/cache@v3
        with:
          path: ${{ env.POETRY_CACHE_DIR }}
          key: ${{ runner.os }}-poetry-${{ hashFiles('**/poetry.lock') }}
          restore-keys: |
            ${{ runner.os }}-poetry-

  pre-commit:
    name: Run pre-commit
    needs: setup
    runs-on: ubuntu-latest
    permissions: 
      issues: write
      pull-requests: write
      contents: write
      actions: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: 3.11.2
      - name: Run pre-commit
        uses: pre-commit/action@v3.0.1

  code-ql:
    name: Run CodeQL
    needs: pre-commit
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      actions: read
      contents: read
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - name: Detect file changes
        id: changes
        uses: dorny/paths-filter@v2
        with:
          filters: |
            python:
              - '**/*.py'
              - 'requirements.txt'
              - 'poetry.lock'
              - 'pyproject.toml'
            javascript:
              - '**/*.js'
              - '**/*.jsx'
              - '**/*.ts'
              - '**/*.tsx'
              - 'package.json'
              - 'yarn.lock'

      - name: Set languages matrix
        id: set-matrix
        run: |
          languages=""
          if [[ "${{ steps.changes.outputs.python }}" == "true" ]]; then
            languages="python"
          fi
          if [[ "${{ steps.changes.outputs.javascript }}" == "true" ]]; then
            if [[ -n "$languages" ]]; then
              languages="$languages,javascript"
            else
              languages="javascript"
            fi
          fi
          if [[ -z "$languages" ]]; then
            echo "No relevant file changes detected, skipping CodeQL"
            exit 0
          fi
          echo "languages=$languages" >> $GITHUB_OUTPUT

      - uses: github/codeql-action/init@v3
        if: ${{ steps.set-matrix.outputs.languages != '' }}
        with:
          languages: ${{ steps.set-matrix.outputs.languages }}

      - uses: github/codeql-action/autobuild@v2
        if: ${{ steps.set-matrix.outputs.languages != '' }}

      - uses: github/codeql-action/analyze@v2
        if: ${{ steps.set-matrix.outputs.languages != '' }}

  test:
    name: Run Tests
    needs: code-ql
    runs-on: ubuntu-latest
    permissions:
      issues: write
      pull-requests: write
      contents: write
      actions: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: 3.11.2
      - run: pip install poetry
      - run: poetry lock --no-update
      - run: poetry install
      - run: poetry run python manage.py collectstatic --noinput
      - name: Run tests
        run: poetry run xvfb-run --auto-servernum python manage.py test -v 3 --failfast

  docker-test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Set up Docker
        run: |
          docker --version
          # Install docker-compose
          curl -sSL https://github.com/docker/compose/releases/download/v2.17.0/docker-compose-$(uname -s)-$(uname -m) -o /usr/local/bin/docker-compose
          chmod +x /usr/local/bin/docker-compose
          docker-compose --version

      - name: Build Docker image
        run: |
          docker build -t my-app .

      - name: Run Docker container
        run: |
          docker run -d --name my-container my-app

      - run: docker exec my-container pip install poetry
      - run: docker exec my-container poetry lock --no-update
      - run: docker exec my-container poetry install --no-dev --no-interaction

      - name: Clean up
        run: |
          docker stop my-container
          docker rm my-container